Redact credentials when displaying URLs by jtfmumm · Pull Request #13333 · astral-sh/uv

jtfmumm · 2025-05-07T16:47:17Z

This PR redacts credentials in displayed URLs.

It mostly relies on a redacted_url function (and where possible IndexUrl::redacted). This is a quick way to prevent leaked credentials but it's prone to programmer error when adding new trace statements. A better follow-on would use a RedactedUrl type with the appropriate Display implementation. This would allow us to still extract credentials from the URL while displaying it securely. On the plus side, the sites where the redacted_url function are used serve as easy signposts for where to use the new type in a future PR.

Closes #1714.

crates/uv-auth/src/cache.rs

crates/uv-auth/src/lib.rs

charliermarsh · 2025-05-07T16:51:53Z

crates/uv/src/commands/reporters.rs

    }

    fn on_checkout_start(&self, url: &Url, rev: &str) -> usize {
+        let url = redacted_url(url);


Why not move this to the use site, like line 320/322?

The idea is to make it more unlikely for future changes to use the Url with credentials. The places I didn't do this were where we were also potentially using the credentials from the Url

crates/uv-auth/src/credentials.rs

crates/uv-git-types/src/lib.rs

charliermarsh · 2025-05-10T14:46:42Z

crates/uv-git-types/src/lib.rs

+            let _ = url.set_password(Some("****"));
+        // A username on its own might be a secret token.
+        } else if url.username() != "" {
+            let _ = url.set_username("****");


It's a little confusing that half of our redact methods remove the credentials entirely, and then half replace them with stars. It's also a little strange (though may not matter in practice) that we're using this version for the cache key, so like the cache key path now includes these stars?

It might be nice to use a different name for these methods that replace with stars vs. those that remove the credentials entirely (like sensitive vs. redact or without_credentials or something).

Or just drop the stars entirely and match the existing redact logic for consistency for now.

It can be helpful to have the stars when debugging but we can defer this decision until after this PR (on main we do it in some places and not others). The follow-up PR will put this decision in one place. To move this PR forward, I've removed the masking from redacted_url and dropped the stars there.

I've also removed all uses from uv-auth (including around the credentials cache). As a result, I've moved redacted_url out of uv-auth and into a new uv-redacted crate. This means we continue to rely on the existing mechanisms for redacting credentials there. This should help move the PR forward and is still a strict improvement.

Agreed! Can definitely be helpful, mostly just pointing out that there are two different behaviors using the same terminology and we probably need to be thoughtful about which we use at each site (e.g., *** for anything in tracing; omitted entirely for anything persisted, like the lockfile).

charliermarsh · 2025-05-12T15:34:58Z

(Seems fine to merge.)

## 0.7.5 ### Bug fixes - Support case-sensitive module discovery in the build backend ([#13468](astral-sh/uv#13468)) - Bump Simple cache bucket to v16 ([#13498](astral-sh/uv#13498)) - Don't error when the script is too short for the buffer ([#13488](astral-sh/uv#13488)) - Add missing word in "script not supported" error ([#13483](astral-sh/uv#13483)) ## 0.7.4 ### Enhancements - Add more context to external errors ([#13351](astral-sh/uv#13351)) - Align indentation of long arguments ([#13394](astral-sh/uv#13394)) - Preserve order of dependencies which are sorted naively ([#13334](astral-sh/uv#13334)) - Align progress bars by largest name length ([#13266](astral-sh/uv#13266)) - Reinstall local packages in `uv add` ([#13462](astral-sh/uv#13462)) - Rename `--raw-sources` to `--raw` ([#13348](astral-sh/uv#13348)) - Show 'Downgraded' when `self update` is used to install an older version ([#13340](astral-sh/uv#13340)) - Suggest `uv self update` if required uv version is newer ([#13305](astral-sh/uv#13305)) - Add 3.14 beta images to uv Docker images ([#13390](astral-sh/uv#13390)) - Add comma after "i.e." in Conda environment error ([#13423](astral-sh/uv#13423)) - Be more precise in unpinned packages warning ([#13426](astral-sh/uv#13426)) - Fix detection of sorted dependencies when include-group is used ([#13354](astral-sh/uv#13354)) - Fix display of HTTP responses in trace logs for retry of errors ([#13339](astral-sh/uv#13339)) - Log skip reasons during Python installation key interpreter match checks ([#13472](astral-sh/uv#13472)) - Redact credentials when displaying URLs ([#13333](astral-sh/uv#13333)) ### Bug fixes - Avoid erroring on `pylock.toml` dependency entries ([#13384](astral-sh/uv#13384)) - Avoid panics for cannot-be-a-base URLs ([#13406](astral-sh/uv#13406)) - Ensure cached realm credentials are applied if no password is found for index URL ([#13463](astral-sh/uv#13463)) - Fix `.tgz` parsing to respect true extension ([#13382](astral-sh/uv#13382)) - Fix double self-dependency ([#13366](astral-sh/uv#13366)) - Reject `pylock.toml` in `uv add -r` ([#13421](astral-sh/uv#13421)) - Retain dot-separated wheel tags during cache prune ([#13379](astral-sh/uv#13379)) - Retain trailing comments after PEP 723 metadata block ([#13460](astral-sh/uv#13460)) ### Documentation - Use "export" instead of "install" in `uv export` arguments ([#13430](astral-sh/uv#13430)) - Remove extra newline ([#13461](astral-sh/uv#13461)) ### Preview features - Build backend: Normalize glob paths ([#13465](astral-sh/uv#13465))

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [astral-sh/uv](https://github.com/astral-sh/uv) | patch | `0.7.3` -> `0.7.5` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (astral-sh/uv)</summary> ### [`v0.7.5`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#075) [Compare Source](astral-sh/uv@0.7.4...0.7.5) ##### Bug fixes - Support case-sensitive module discovery in the build backend ([#13468](astral-sh/uv#13468)) - Bump Simple cache bucket to v16 ([#13498](astral-sh/uv#13498)) - Don't error when the script is too short for the buffer ([#13488](astral-sh/uv#13488)) - Add missing word in "script not supported" error ([#13483](astral-sh/uv#13483)) ### [`v0.7.4`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#074) [Compare Source](astral-sh/uv@0.7.3...0.7.4) ##### Enhancements - Add more context to external errors ([#13351](astral-sh/uv#13351)) - Align indentation of long arguments ([#13394](astral-sh/uv#13394)) - Preserve order of dependencies which are sorted naively ([#13334](astral-sh/uv#13334)) - Align progress bars by largest name length ([#13266](astral-sh/uv#13266)) - Reinstall local packages in `uv add` ([#13462](astral-sh/uv#13462)) - Rename `--raw-sources` to `--raw` ([#13348](astral-sh/uv#13348)) - Show 'Downgraded' when `self update` is used to install an older version ([#13340](astral-sh/uv#13340)) - Suggest `uv self update` if required uv version is newer ([#13305](astral-sh/uv#13305)) - Add 3.14 beta images to uv Docker images ([#13390](astral-sh/uv#13390)) - Add comma after "i.e." in Conda environment error ([#13423](astral-sh/uv#13423)) - Be more precise in unpinned packages warning ([#13426](astral-sh/uv#13426)) - Fix detection of sorted dependencies when include-group is used ([#13354](astral-sh/uv#13354)) - Fix display of HTTP responses in trace logs for retry of errors ([#13339](astral-sh/uv#13339)) - Log skip reasons during Python installation key interpreter match checks ([#13472](astral-sh/uv#13472)) - Redact credentials when displaying URLs ([#13333](astral-sh/uv#13333)) ##### Bug fixes - Avoid erroring on `pylock.toml` dependency entries ([#13384](astral-sh/uv#13384)) - Avoid panics for cannot-be-a-base URLs ([#13406](astral-sh/uv#13406)) - Ensure cached realm credentials are applied if no password is found for index URL ([#13463](astral-sh/uv#13463)) - Fix `.tgz` parsing to respect true extension ([#13382](astral-sh/uv#13382)) - Fix double self-dependency ([#13366](astral-sh/uv#13366)) - Reject `pylock.toml` in `uv add -r` ([#13421](astral-sh/uv#13421)) - Retain dot-separated wheel tags during cache prune ([#13379](astral-sh/uv#13379)) - Retain trailing comments after PEP 723 metadata block ([#13460](astral-sh/uv#13460)) ##### Documentation - Use "export" instead of "install" in `uv export` arguments ([#13430](astral-sh/uv#13430)) - Remove extra newline ([#13461](astral-sh/uv#13461)) ##### Preview features - Build backend: Normalize glob paths ([#13465](astral-sh/uv#13465)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

jtfmumm temporarily deployed to release May 7, 2025 16:47 — with GitHub Actions Inactive

charliermarsh reviewed May 7, 2025

View reviewed changes

crates/uv-auth/src/cache.rs Outdated Show resolved Hide resolved

charliermarsh reviewed May 7, 2025

View reviewed changes

crates/uv-auth/src/lib.rs Show resolved Hide resolved

charliermarsh reviewed May 7, 2025

View reviewed changes

jtfmumm force-pushed the jtfm/redact-urls branch from 4dccf8e to 249a8bc Compare May 7, 2025 16:54

jtfmumm temporarily deployed to release May 7, 2025 16:54 — with GitHub Actions Inactive

jtfmumm closed this May 7, 2025

jtfmumm reopened this May 7, 2025

jtfmumm force-pushed the jtfm/redact-urls branch from 1bced63 to 0e2aab1 Compare May 7, 2025 21:46

charliermarsh reviewed May 7, 2025

View reviewed changes

crates/uv-auth/src/credentials.rs Outdated Show resolved Hide resolved

jtfmumm mentioned this pull request May 9, 2025

Token is not redacted in "TRACE Fetching metadata for typer from https://token:[email protected]/basic/data/python/simple/typer/" log lines #13357

Closed

jtfmumm added 2 commits May 9, 2025 19:20

Redact URL credentials when displaying

1cd92cf

Add cache test

47c73b7

jtfmumm force-pushed the jtfm/redact-urls branch from fec860f to f0c0f0b Compare May 9, 2025 18:20

Remove redacted_url tracing gate

b58b90b

jtfmumm force-pushed the jtfm/redact-urls branch from f0c0f0b to b58b90b Compare May 9, 2025 21:52

charliermarsh approved these changes May 10, 2025

View reviewed changes

Move redacted_url into crate and stop using in uv-auth

d284192

jtfmumm temporarily deployed to release May 11, 2025 12:24 — with GitHub Actions Inactive

Remove credentials instead of obfuscating when redacting

c2a0527

jtfmumm temporarily deployed to release May 11, 2025 12:37 — with GitHub Actions Inactive

..

b569dc7

jtfmumm temporarily deployed to release May 12, 2025 15:43 — with GitHub Actions Inactive

jtfmumm temporarily deployed to uv-test-publish May 12, 2025 15:47 — with GitHub Actions Inactive

jtfmumm merged commit 6df588b into main May 12, 2025
109 checks passed

jtfmumm deleted the jtfm/redact-urls branch May 12, 2025 16:58

BrewTestBot mentioned this pull request May 15, 2025

uv 0.7.4 Homebrew/homebrew-core#223581

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Redact credentials when displaying URLs#13333

Redact credentials when displaying URLs#13333
jtfmumm merged 6 commits intomainfrom
jtfm/redact-urls

jtfmumm commented May 7, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

charliermarsh May 7, 2025

Uh oh!

jtfmumm May 7, 2025

Uh oh!

Uh oh!

Uh oh!

charliermarsh May 10, 2025

Uh oh!

jtfmumm May 11, 2025 •

edited

Loading

Uh oh!

charliermarsh May 12, 2025

Uh oh!

charliermarsh commented May 12, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

jtfmumm commented May 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

charliermarsh May 7, 2025

Choose a reason for hiding this comment

Uh oh!

jtfmumm May 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

charliermarsh May 10, 2025

Choose a reason for hiding this comment

Uh oh!

jtfmumm May 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

charliermarsh May 12, 2025

Choose a reason for hiding this comment

Uh oh!

charliermarsh commented May 12, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jtfmumm commented May 7, 2025 •

edited

Loading

jtfmumm May 11, 2025 •

edited

Loading